LICENSE

Dokan Conditional Category Attributes — Authorization & Licensing Notes

Version: 2.0.0 (Server) / 2.0.0 (Plugin)
Developer: Dokan Conditional Category Attributes
Last Updated: June 2026

1. Authorization System Overview

Dokan Conditional Category Attributes uses a server-bound authorization system that validates license keys against the Dokan Conditional Category Attributes licensing server. The system is designed to protect commercial distribution while ensuring legitimate customers retain full feature access.

Key Principles:

• Authorization is required for all attribute filtering features to function

• First-activation expiry — the timer starts when you first activate, not when you purchase

• Status is dynamic — recalculated from live database on every request (zero caching)

• Domain-bound — each production domain consumes one activation slot

• Graceful degradation — without active authorization, the plugin UI shows a lock overlay but preserves your configuration data

2. Authorization Tiers

Key Format: DKN-XXXX-XXXX-XXXX-XXXX (auto-generated, uppercase)

3. Status Definitions & Behavior

The authorization system uses four distinct statuses. Understanding these is critical for troubleshooting:

Important: Only EXPIRED and SUSPENDED statuses block activation. INACTIVE simply means “available to use.”

4. Activation Process

Step 1: Enter Authorization Token
Navigate to Authorization Manager in your WordPress admin menu. Enter your DKN- token in the activation field.

Step 2: Domain Resolution
The plugin extracts your site URL, strips the www. prefix, and transmits:

• License key

• Site domain

• Site URL

• API secret (for server validation)

Step 3: Server Validation
The server checks:

• Does the key exist?

• Is the status not expired or suspended?

• Does the domain already exist (reactivation) or are slots available?

• Is this the first activation? (If so, sets first_activation_date and calculates expiry_date)

Step 4: Local Storage
On success, the plugin stores:

• Token, status, type, max sites

• Expiry date and remaining days

• First activation date

• Activated-at timestamp

• Integrity fingerprint (anti-tamper)

5. Expiry Mechanics (First-Activation Based)

Unlike traditional licenses that expire from purchase date, this system uses first-activation expiry:

Before First Activation:

• Status: INACTIVE

• Expiry: null (displayed as “Waiting for first activation”)

• The timer only starts when you click Activate

Auto-Correction: On every sync/validation, the server recalculates expiry_date from + product config. This prevents drift if the database is manually edited.

6. Domain Binding Rules

What Counts as a Site?

• Production domains: example.com, shop.example.com — each counts as one binding

• Staging subdomains: Typically permitted under the same root domain but may require verification

• Localhost / .local: Permitted for development; may require manual override

Reactivation
If your domain is already registered (e.g., after a plugin reinstall):

• The server updates last_checkin and returns “Already active”

• No additional slot is consumed

• Expiry is not reset

Site Migration

• Deactivate on the old domain first (via Authorization Manager)

• Activate on the new domain

• If the old domain is inaccessible, contact support with your token and proof of ownership

7. Deactivation

Client-Side Deactivation
Click Deactivate Authorization in the Authorization Manager. This:

• Opens a confirmation modal (prevents accidental clicks)

• Sends deactivate request to the server

• Marks the site as inactive in the database

• Triggers status sync (may set license to INACTIVE if no active sites remain)

• Clears all local authorization options

• Updates the UI to show the activation form (no page reload)

Admin-Initiated Deactivation (Server)
From the license server admin panel, you can:

• Suspend a license: Blocks all activations/validations, pings all client sites to disable features

• Deactivate a single site: Removes one domain from a multi-site license without affecting others

8. Feature Lock Behavior

When authorization is missing, expired, or suspended:

Data Preservation: Your category-to-attribute mappings (_allowed_attributes term meta) are never deleted during deactivation. Reactivating the same license restores full functionality instantly.

9. Update Checking

The plugin contacts server to check for updates:

Requirements for updates:

• Valid ACTIVE authorization

• Current version transmitted to server

• Domain validated against active sites list

Update response includes:

• New version number

• Download URL (signed)

• Tested WordPress/PHP versions

• Changelog sections

10. Integrity & Security

Anti-Tamper Measures
The plugin generates an integrity fingerprint from:

plain

If local options are manually edited, the fingerprint mismatch triggers a forced server re-sync. If re-sync fails, features are locked.

Zero-Cache Headers
All API responses include aggressive no-cache headers to prevent proxy/CDN caching of authorization state.

API Secret Validation
All server requests require a shared api_secret. Requests without it receive HTTP 401.

11. FastSpring Integration

For purchases through FastSpring:

• Order completed → Webhook creates license key in database

• Subscription renewed → expiry_date extended by tier’s expiry_years

• Subscription canceled → License set to INACTIVE

• Refund issued → License set to INACTIVE

Product Mapping:

12. Troubleshooting

“Authorization Required” Lock Overlay

• Your license is inactive, expired, or suspended

• Navigate to Authorization Manager and check status

• Click Sync Now to refresh from server

“Maximum site limit reached”

• Your tier’s site slots are full

• Deactivate unused sites or upgrade to a higher tier

“License has expired”

• Purchase a renewal through your original channel

• The renewal extends from the original expiry date (no lost time)

“Server returned invalid response”

• Check that your server can reach https://dokanconditionalattribute.com

• Verify SSL/TLS is enabled on your hosting

• Check server logs for blocked outbound requests

Sync Shows “Stale”

• Last sync was >30 seconds ago

• Click Sync Now or Quick Sync (AJAX, no reload)

• If persistent, check server connectivity

13. Glossary

These notes reflect the current implementation as of License Server v2.0.0 and Plugin v2.0.0. For the latest terms, always refer to your purchase agreement and the live documentation.